PT-2022-11568 · Elan · Elan Miniport Touchpad Windows Driver

Published 2022-11-07 · Updated 2022-11-09 · CVE-2021-42205

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ELAN Miniport touchpad Windows driver versions prior to 24.21.51.2

Description The issue allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice. This is related to the handling of specific requests by the driver.

Recommendations For versions prior to 24.21.51.2, update to version 24.21.51.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the IOCTL request handling mechanism until a patch is available.

Fix

Weakness Enumeration

CWE-703

Related Identifiers

CVE-2021-42205

Affected Products

Elan Miniport Touchpad Windows Driver

References · 6

• https://osv.dev/vulnerability/CVE-2021-42205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42205 · Security Note
• https://t.me/cibsecurity/52604 · Telegram Post
• https://t.me/cvenotify/37418 · Telegram Post
• https://t.me/cvenotify/37217 · Telegram Post
• https://emc.com.tw/upload/F2E/Vulnerability%20Report/Vulnerability%20Report_Miniport%20touchpad%20Windows%20driver_20221107.pdf · Note